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, Abstract 

We present evidence that there exist quantum computations that can be carried out in 
constant depth, using 2-qubit gates, that cannot be simulated classicahy with high accuracy. 
We prove that if one can simulate these circuits classically efficiently then BQP C AM. 

^ . 

^ ■ 1 Introduction 
m 



The idea of quantum teleportation |BBC"'"93j , transferring a quantum state by dual usage of clas- 



^ . sical measurement data and quantum entanglement, has found a profound application in quantum 

I computation. It has been understood by Gottesman and Chuang |(-r('99j that not only states, but 

' also quantum gates, can be teleported. This observation has given rise to a new paradigm for 

quantum computation, which we will refer to as adaptive quantum computation. 
Oh! In adaptive quantum computation, the outcomes of measurements performed throughout the 

^ course of the computation determine the quantum gates that are subsequently performed on the 

■ quantum registers ^; the quantum program is "adapted" to the classical measurement data. 

^ . Nonadaptive quantum computation, which we explore in this paper, is a new computational 

model derived from the adaptive scheme. In this model we introduce a 'guess' bit string g; g is 
a prior guess of the outcome of all of the quantum measurements performed in the course of the 
^ . adaptive quantum computation. This guess can be compared with the actual quantum measurement 

^ I outcomes (which can now be deferred to the end of the computation, since no quantum gate 

operations depend on them). In the (rare) case that all these outcomes agree with the guess, the 
quantum computation can be called successful, and we know when it occurs. This suggests such 
quantum circuits could be hard to simulate classically, i.e. if we were able to consider all possible 
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outcomes in our classical simulation, -including the rare one that corresponds to having guessed 
correctly- , then our classical simulation would simulate the output of a polynomial-time quantum 
computer on the remaining output bits. 

On the other hand, the interesting feature of nonadaptive models is that it can lead to quantum 
circuits of restricted depth. The adaptive model by Gottesman and Chuang (and similarly the 
one in [EBDlj ) in which two-qubit gates are 'teleported' into the circuit and single-qubit gates 
are performed normally, maps to a nonadaptive model of constant depth (Lemma That is, 
the resulting quantum circuit can be implemented in a constant number of time steps, which 
seems to make it very weak. The idea of computation by teleportation is also the basis for the 
Knill-Laflamme-Milburn proposal of quantum computation by linear optics [KLMDlj (see also the 
scheme by Gottesman, Kitaev and Preskill [(irKPnij ). A nonadaptive version of the Knill-Laflamme- 
Milburn construction also exists; however, because this model, involving a quantum circuit with 
passive linear optics applied to single photon states and followed by photon counting measurements, 
does not conform to the standard qubit model, the resulting nonadaptive circuit is not of constant 
depth. It could be of reduced depth, for example logarithmic depth, but this has not been proved. 

The fact that nonadaptive parallelized quantum models can be of constant depth makes it likely 
(although not certain) that such models have no (quantum) computational power whatsoever. One 
may also expect that they can be simulated efficiently by a classical algorithm. However, we will 
provide evidence in this paper that, in fact, it may be hard to simulate these models classically. 
The results are the following: 

1) We imagine that there is style of classical simulation that is powerful enough to follow any 
computational pathway, regardless of its probability of occurrence. We call this type of simulation 
by density computation. At the end of the paper we prove that if such a simulation of the constant 
depth quantum circuits is possible then BPP = BQP and also the polynomial hierarchy collapses 
(Corollary 13). 

2) Even if the simulation does not have this extended power, there is another well-known 
technique of endowing such a simulation with greater power; if an all-powerful 'Merlin' can direct 
the use of the simulation by 'Arthur', then Merlin can steer the simulation to the rare, successful 
cases. If such a simulation of constant depth quantum circuits were possible, it would mean 
that polynomial-time classical circuits, assisted by Merlin, would necessarily be able to simulate 
any polynomial-time quantum circuit. In complexity-theoretic language, this would imply the 
containment BQP C AM (AM=' Arthur-Merlin') (Theorem EJ . 

1.1 Previous work 

Constant-depth quantum circuits, but with gates that have arbitrary fan-in, have been studied 
previously, see for example Ref. |GHMPn2] . The constant depth circuits that we consider here 
have fan-in at most two. In the setting of classical boolean circuits, there are arguments that use 
a reduction to a constant-depth model by enumeration of the inputs and outputs of each gate in 
the circuit |Has87j : these arguments are somewhat akin to the ones we use here. 
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2 Definitions 



2.1 Basic Concepts 

We use the following standard notation. All strings are over the alphabet S = {0, 1}, S* is the set 
of all finite strings and |x| denotes the length of the string x. 

Definition 1 (Quantum Register QR{w)). A quantum register of w qubits is a tensor product 
of 2 dimensional 'qubit' Hilbert spaces 7^2; 'H = Tif^ of total dimension 2"'. Allowed states are 

unit-norm vectors {ip) in this space. The complex inner product in this space is denoted by {v\w) = 
where \v) = and i is w-bit string. The standard (computational) basis is formed 

by w-bit strings \i) = \ii,i2, is, ■■■,iw)- 

Definition 2 (Quantum Gate). The action of a general one-qubit gate is described by an element 
of SU(2), which is applied to the vector describing the state of that qubit. The action of a general 
two-qubit gate is described by an element of SU(4), which is applied to the vector describing the 
state of that pair of qubits. It is understood that if a one- or two-qubit gate is applied to particular 
qubit(s) of a register QR{w), the unitary transformation on the full 2^ -dimensional state vector is 
obtained by a tensor product of the gate action on the specified qubit(s) with the identity operation 
on all other qubits. 

Definition 3 (Quantum Measurement M in the Standard Basis). A quantum measurement 

in the standard basis is an operation applied to one qubit in a quantum register. If the number of 
qubits in the register is w, then the output of the measurement is a single bit b E Ti and a smaller 
quantum register, of size w — 1, consisting of the unmeasured qubits. The bit b occurs with probability 
p{b) = Tr{I® \b){b\\il)){il^\) . Here I is the identity operator on the 2^~^ -dimensional Hilbert space of 
the unmeasured qubits. When the measurement outputs the bit h, the new state of the unmeasured 
qubits is IV-b) = Y^^i^^w-i \b'){b' ,b\f) / y/p{b). 

Measurements M. on different qubits commute, so we may consider a composite standard 
measurement on k qubits with output bit string b s& k measurements applied to each of these 
qubits. Two-qubit measurements can be considered as a composite of some two-qubit quan- 
tum gate applied to the pair of qubits to be measured, immediately followed by a standard 
measurement M. on the two qubits. Of particular importance is the two-qubit measurement 
called a Bell measure/ment For this, the two qiibit unitary transformation preceding Jvi is of 
the form U = |00)(*+| + |01)(^'"i + |10)(<J>+| + where the Bell states are defined as 

= ^(|00) ± 111)) and |*±) = ^(|01) ± |10)). 

Definition 4 (Quantum Circuit QCx{w,w' ,\init),d)). A quantum circuit, determined by bit 
string x, of input width w, depth d, and classical output width w' < w consists of a quantum 
register QR{w) set initially (called time-step 0) to Hilbert-space vector \init). In each time-step 
1 through d — 1 the quantum register is acted upon by one qubit or two qubit gates. Time-step d 
consists of a standard quantum measurement M applied to some subset of w' < w of the qubits; 
the output of the quantum circuit is a bit string of length w' and aw — w' -qubit quantum state. 

We will often abbreviate our notation for a quantum circuit to QC {\init) , d) . Quantum circuits 
can be composed: 

QCx^iw - w',w", \ipb),d2) * QCx^iw,w', \init),di) (1) 
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denotes a new circuit in which the unmeasured qubits of circuit QCx^, in state \^pb) {b is the bit 
string of the measurement outcome), are fed into a second quantum circuit QCx2- So long as QCx2 
does not depend on 6, this composed circuit is identical to some single circuit QC'^{w,w" , \init),d') 
with d! < di + d2- But in the following we will consider cases where QCx2 does depend on the 
measurement outcomes b. 

Definition 5 (BQP). A language L <^ Ti* is in BQP ifix ^ L M{x) = 1 with probability larger 
than or equal to 2/3 where M is a uniformly generated family of quantum circuits QCx{w, w' , \0),d) 
with w and d polynomial in \x\, and one of the w' output bits gives the value M{x); when x ^ L 
then M{x) = 1 with probability smaller than or equal to 1/3. 

The class AM defined by Babai r |Bah85j and |MM88j 1 is an extension of the nondeterministic 
class NP where we allow randomness and interaction in the verification procedure. Here is a formal 
definition: 

Definition 6 (AM). A language L <^ Ti* is in AM if, \/x €z L there exists a strategy for Merlin 
such that a polynomial time computation in \x\ by Arthur accepts with probability larger than or 
equal to 2/3. If x ^ L then for all strategies of Merlin, Arthur accepts with probability smaller 
than 1/3. A 'strategy' is implemented in the following way: Arthur begins by sending a random bit 
string b (\b\ = poly{\x\)) to Merlin. Merlin, after performing some (arbitrarily powerful) classical 
computation on b, obtains bit string m which he returns to Arthur. Arthur performs a polynomial 
time computation with m as input, obtaining a single-bit output M(x). The acceptance probability 
isp{M{x) = 1). 

2.2 Adaptive and nonadaptive quantum computation 

We now formalize what we mean by an adaptive quantum computation model: 

Definition 7 (QCad)- The class of adaptive quantum computations QCad consists of all composed 
circuits of the form 

QCx,bi,b2,-bR{\AR),dR+i) * ... * QCx,bi,b2i\^b2),d3) * QCx,bA\i'bi),d2) * QCx{\init) , di) . 

This composition is adaptive in the sense that the description of the second circuit QCx^^ is a 
function of the measurement outcome of the first circuit bi as well as of the problem specification 
x; the description of the third circuit QCx,bi,b2 ^-^ o, function of the measurement outcomes of the 
first two, and so on. The depth parameters di through d^^i, and the number of rounds R + 1, 
should be polynomial in \x\, as should all the widths; also, for uniformity, the boolean functions 
determining the quantum circuit at every round from the previous measurement outcomes and the 
input x should be efficiently implementable. 

While QCad has no greater power than the set of ordinary quantum circuits QC, Gottesman and 
Chuang's work shows that the universal operations for QCad could be quite different than for QC. 
Their main theorem, stated informally, is that one-qubit gates alone are sufficient to implement all 
operations in QCad, provided that \init) consists of a sufficient supply of entangled states as well 
as qubits in the |0) state, and that the quantum circuits composing QCad are permitted to perform 
Bell measurements (see Sec. 

Now we introduce a new model, nonadaptive quantum computation which we derive from QCad 
and which we will use to deduce interesting constraints relating simulatability of quantum circuits 
and quantum complexity classes. 
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Definition 8 {QCnad)- With each member QCad £ QCad we associate a set of members QCnadig) S 
QCnad, one for each distinct value of the 'guess' bit string g. The nonadaptive quantum computation 
so obtained is the composed quantum circuit 

QCx,gi,g2,...gR (lV'bB>,c?i?+i) * ■■■QCx,g^,g2{\i^b2),d3) * QC^,gi(|V'6i),c?2) * QCx{\init) , di) . (2) 

The only difference between QCad and QCnad{g) is that the circuit's dependence on the mea- 
sured values 6i,62i--- in QCad is replaced by the guessed values gi,g2,--- in QCnadio)- Because 
of this, all intermediate measurements in the nonadaptive circuit can be moved to the end, and 
the circuit can be viewed as a single ordinary quantum circuit, with no measurements during the 
computation. 

3 Classical Simulations 

We formalize the notion of classical simulatability with a certain accuracy: 

Definition 9 {S^{QC)). An efficient simulation S^{QC) (with accuracy parameter e) of a (uniformly 
generated) family of quantum circuits QC exists if for each QC{w, w' , |0), d) G QC there is a classical 
boolean circuit with depth d' and input width r (r,d' = poly{w,d)), and output width w' , such that 
yh, \N{h)/2'^ — Pqc{^)\ < ^PQc{t>)- Here, PQc{b) is the probability that the measured state of the 
output quantum register is b for a particular quantum circuit QC; N{b) is the number of settings of 
the input register of the classical circuit that simulates QC, for which the classical circuit outputs 
b. The classical circuits are uniformly generated from the description of the QC -circuits. 

A stronger type of classical simulation is one where one can explicitly calculate the (conditional) 
probability of a certain set of outcomes, and then sample this probability distribution. Here is our 
definition: 

Definition 10 {S'-'{QC)). An efficient density computation of a (uniformly generated) family of 
quantum circuits QC is one that proceeds as follows: we first divide up the full quantum measurement 
at the end of QC £ QC into separate measurements Aii, M2, ■■■ on disjoint sets of qubits that 
contain a constant number of qubits. Let bi denote the set of potential outcomes of measurement 
Mi, and let h\ denote an outcome. An efficient density computation exists if there exist polynomial- 
time (in the width and depth of QC{w,w' ,\0),d) £ QC) uniformly generated classical procedures 
for evaluating the conditional probabilities 



Here the set of indices ji, . . . ,jk can be any subset (including the empty set) of the set of measure- 
ments M. = {M.i,M.2, •••} and i ^ ji . . . jk labels any other measurement. 

For an example of a density computation, see the simulation algorithm in Ref. |Val02j . This 
definition leads obviously to 

Proposition 1. If an efficient density computation exists, it provides the means for performing an 
efficient simulation with e = 0. 




(3) 
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Proof. We proceed as follows. We pick a first measurement Mi (it does not matter which one 
since they all commute) and calculate p{bi), i.e. we calculate a constant number ci of probabilities, 
where ci is the number of outcomes of A^i. We flip coins according to the probability distribution 
p{bi) and fix the outcome bi. Then we pick a next measurement M.2 and we calculate p(62|bi), 
again a constant number of probabilities. We flip coins, fix the outcome and proceed to the next 
measurement Ms etc. There are no more than w measurements (for a quantum circuit QC of 
width w) and thus in total we calculate at most wmaxiCi conditional probabilities. □ 

Remark: One may also consider density computations with accuracy parameter 6 in which the 
conditional probabilities can be calculated as \psimi-\-) —p{-\-)\ < ^p{-\-)- If (5 = 2™ '°s{i+<:) _ i -^^here 
w is the width of the quantum circuit (for large width w, 6 ^ ^ ln(l + e)), then this will provide 
a way to do an simulation with accuracy parameter e. 

Definitions 9 and 10 relate to regular quantum circuits QC but can be extended in a straight- 
forward way to adaptive quantum circuits QCad by restricting ourselves in the density computation 
Definition 10 to estimating conditional probabilities where (intermediate) measurement Mi occurs 
after the (intermediate) measurements labeled by ji, . . . ,jk- 

In the 'density computation' setting, there is a close connection between the simulation of 
adaptive and nonadaptive circuits: 

Theorem 1. // there exists an efficient density computation of QCnad{g) G QCnad for all g, then 
there is a simulation with accuracy parameter (e = 0) for QCad ^ QCad- 

Proof. The simulation of QCad will be a direct adaptation of the algorithm for the density com- 
putation of QC^adid) foi' some g. We consider the composed quantum circuit in Definition Q for 
QCad- The first member of this composition, QCx{\init) ,di), is by itself an example of a non- 
adaptive circuit and can be simulated efficiently by the hypothesis. We fiip coins biased according 
to the outcome probabilities of A^i (the measurement following QCx) and we fix the outcome, 
say hi = bi. This fixes the second circuit in the composition QCx^bi and any further choices of 
gates and measurements depending on bi. Now we consider two stages of the quantum circuit, 
QCa;,bi (IV'bi)i (^2) * QCx{\init) , di) . Since the second circuit is now fixed, it is no longer adaptive 
and we may consider the pair as a single nonadaptive quantum circuit with guess bit g = hi; the 
measurements Mi and M2 (the measurement following QC^^bi) may be moved to the end. Since we 
have already fixed the outcome of measurement A^i, we are interested in sampling from the proba- 
bility distribution of outcomes of M2 given 61 = bi. By hypothesis, our classical algorithm can do 
this by, for example, letting us calculate the conditional probability distributions ^(62(^^2) I bi). By 
computing the constant number of quantities p{b2{M2)\hi) and flipping coins we can implement 
measurement M2- We fix its outcome, say 62 = b2 and proceed as before to the third measurement 
by moving it to the end and using the density computation of some nonadaptive circuit with guess 
bits g = bib2, etc. Note that if A^i, M2, etc., do not have a constant number of outcomes, the 
circuit can always be broken up into a larger number of stages, where the number of outcomes for 
each of these sub-stages is constant. □ 

A special case occurs when the probability distribution over the output bits 61, . . . , 6^ of a circuit 
QCad does not depend on the outcomes of the intermediate measurements, in other words QCad 
represents the same logical circuit on the qubits independent of the outcome of these intermediate 
measurements. An example is the Gottesman-Chuang construction considered in the next section. 
These kind of circuits are the ones of interest since we want to implement a fixed circuit and not a 
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mixture of circuits. We denote this class of circuits with an additional label 'fix', i.e. QCadjix- In 
that case we also have 

Theorem 2. If there exists an efficient density computation of QCnadjixid) ^ QCnadjix for all g, 
then there is an efficient density computation for QCadjix S QCadjix- 

Proof. Consider QCadjix with a certain set of intermediate measurement outcomes g' . We know 
that the probability distribution of outcomes of QCadjix p{bi ■ ■ ■ bk\g') is identical to the probability 
distribution of outcomes of QCnadjixio')- Since also p{bi . . . bk\g') = p{bi ■ ■ - bk) the efficient density 
computation of QCnadjixid') 

can be directly used to do an efficient density computation of QCadjix- 

□ 

Our second theorem has interesting consequences when applied to a subset of QCadjix circuits 
that give universal quantum computation: 

Corollary 1. Suppose the set {QC^ jj^^} C QCadjix contains a universal set of quantum circuits, 
sufficient to implement all polynomial-time quantum computations (where each QC^^ j:^^ is such that 
the logical circuit on the qubits does not depend on the outcomes of the intermediate measurements) . 
If there is an efficient density computation of the corresponding nonadaptive set {QC^^^^ j^^{g)} for 
all g, then for the polynomial hierarchy PH we have PH = BPP = BQP (thus the polynomial 
hierarchy would collapse to S2 since BPP G \La.u8^ ). 

Proof. If the simulations of the nonadaptive circuits are possible, then by Theorem^all the adaptive 
simulations are also possible. The density computation of Theorem [21 does more than simply 
providing a simulation; it provides a means of calculating the outcome probability of any polynomial 
depth quantum circuit. It has been shown |FGHP99j that determining the acceptance probability 
of a quantum computation which we would be able to do if we could calculate all joint probabilities, 
is equivalent to the complexity class coC=P. Therefore we would have coC=P C BPP. On the 
other hand, it is known that PH C bPP^^p and thus PH C BPP^^P = BPP. □ 

This corollary has more explicit consequences if we consider its application to the Gottesman- 
Chuang adaptive computation model, which we now examine in more detail. 

4 Constant-Depth Quantum Circuits 

The Gottesman-Chuang construction for quantum computation starts from the well-known fact that 
there exist universal quantum gate sets containing only a single two-qubit gate, the controlled-NOT, 
along with certain one-qubit gates. They obtain adaptive circuits from such a standard quantum 
circuit by a one-for-one replacement of each CNOT in the circuit by the teleportation protocol 
outlined in Fig. ^a). The entangled four-qubit state \ ^c) can be created "offline" at the beginning 
of the computation by the procedure shown in Fig. WL^)- 

We formally define the class of circuits QCad C QCad obtained in this fashion: 

Definition 11 {QCad)- ^ quantum circuit G G QCad C QCad when 1) All the quantum circuits 
QCbi,b2,... composing G contain only one-qubit gates; 2) The initial state \init) consists of some 
qubits in state |0) and others in the entangled four qubit state |^'c). The qubits of^c f^fs labeled 
"1" to "4", see Fig. W(b); 3) Each intermediate measurement consists of two Bell measurements. 
The first of these Bell measurements (see Fig. U](a)) uses qubit "1" of a 'new' that has not been 
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Figure 1: (a) The Gottesman-Chuang implementation of the CNOT gate by teleportation. In 
addition to the two qubit inputs qi and q2, the teleportation circuit has four additional ancilla 
qubit inputs ("1", "2", "3", "4") preset to the entangled state \^c)- Two Bell measurements 
(B.M.) are performed as indicated, resulting in two bit-pairs bi and b2 as output. These bit 
pairs determine the parameters of two one-qubit quantum gates U and V. (b) Construction of the 
entangled state \^c)- H is the one-qubit Hadamard gate, specified by the 2x2 matrix (-|^_^-^)/\/2. 
The dotted box (which can be completed in one time step) causes the creation of the entangled 
state between ancilla bits "1" and "2" and between "3" and "4" . The final CNOT constitutes 
the "offline" application of the two-qubit gate as mentioned in the text. 



acted upon previously, and some other arbitrary qubit in the circuit. The second measurement uses 
qubit "4 " of the same o-'^'d some other arbitrary qubit. 

The nonadaptive circuits corresponding to QCad are of constant depth: 

Lemma 1. Consider any circuit G £ QCad; o-iT-d consider the corresponding set of nonadaptive 
circuits G{g) which together make up the set GCnad- Any circuit in GCnad has at most depth four, 
using one and two-qubit gates and starting with the state |00 . . . 0). 

Proof. The essential idea behind the depth-reduction is that in the nonadaptive model the Bell 
measurements can be done at the end and all further gates in the quantum circuits are one-qubit 
gates given a preparation of the states (which can also be done in a few time-steps). The 
nonadaptive circuit has the following form. In the first time step (/) one creates a set of entangled 
states ^>~'' by performing a set of 2-qubit gates all acting in parallel. At the same time, we perform 
some single-qubit gates on the other qubits, the 'data qubits'. The second time step (77) is built out 
of two steps. We do CNOT gates on halves of the entangled states; the target and control bits are 
each half of a different entangled state (so as to create ^c)- Then we do some single-qubit gates on 
the qubits "2" and "3" (see Fig. E^b)) that went through these CNOT gates. These two steps can 
be merged into one by permitting arbitrary 2-qubit gates on halves of the entangled states. Then 
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we rotate some qubits from the Bell basis to the standard basis (///) and in the final time step we 
perform single-qubit measurements in the computational basis {IV). □ 



The restricted form of the GCnad circuits leads to a conclusion about the simulatability of 
constant-depth quantum circuits: 

Corollary 2. // there is an efficient density computation of all quantum circuits QC{\0),d = 4), 
then PH C BPP and BQP C BPP and thus PH = BPP = BQP. 

Proof. Immediate, by application of Corollary ^ and Lemma ^ □ 

This corollary indicates that a classical simulation, at least of the density computation type, 
of constant depth quantum circuits, is quite unlikely to be possible. This may be considered a 
surprising result, since it is clear that for a quantum circuit of constant depth d and width n, 
any measurement on log n qubits can be efficiently reproduced by a classical density computation, 
that is, the family of quantum circuits {QC{n,\ogn, \0),d)} is simulatable for constant d. In the 
past history of a single qubit there is only a total constant number (2"^) of qubits with which it 
has interacted and therefore the output state of log n qubits can be determined by following the 
evolution of at most 2'^logn input qubits. We can thus simulate the measurements on logn qubits 
by following the amplitudes during the computation and tracing over outputs that are no longer 
in the past history cone of the output qubits of interest. 

We now note that the depth of four, singled out by the Gottesman-Chuang construction, is the 
smallest depth for which Corollary |21 holds: 

Proposition 2. An efficient density computation exists of all quantum circuits of depth three, 
QC(|0),d = 3). 

Proof. We give the simulation. After the first time step the quantum state of the circuit consists of 
a set of 2-qubit entangled states and possibly some 1-qubit states and thus the amplitudes of this 
state can be efficiently represented classically. We may consider the second computing step and 
the final measurement step as one single step in which a set of final measurements are performed 
in arbitrary 2-qubit bases. We pick a first measurement. It is simple to calculate the probabilities 
for the various outcomes since they depend on the state of no more than four qubits. We fiip coins 
according to the outcome probabilities and fix the outcome. We replace the 4-qubit state by the 
post-measurement projected state consisting now of 2 qubits. We pick the next measurement and 
proceed similarly etc. If only a subset of these measured bits are required as output, the rest are 
simply discarded. □ 

It is clear that adding a fourth layer of computation will break the method of proof for the 
proposition. The problem is that each final measurement in the Bell basis leaves an entangled 
state with more qubits which may not have an efficient classical representation. The reason that a 
constant-depth quantum computation could be hard to simulate classically may be precisely this. 

4.1 General Simulations 

As we argued above, the constant-depth QCnad model is able to perform quantum computation - the 
probability of success is exponentially small, but there is a flag that indicates when the successful 
outcome is achieved. This means that if there were a classical algorithm of any sort that simulates 
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the constant-depth QCnad model, then there would exist an efficient classical probabilistic algorithm 
that could simulate a polynomial-time quantum computation with exponentially small probability, 
but with a success flag. Even though such a simulation would not be useful, it would nevertheless 
have some interesting consequences for computational complexity classes. In particular, we will 
relate the class BQP to the classical nondeterministic complexity class AM (for Arthur-Merlin). 
We consider the circuits G{g = 0) G QCnad which have guessed outcome corresponding to U = I 
and V = I after every Bell measurement |GC99j . The following theorem is proved for these circuits 
with 5 = 0, but holds equally well for other values of g: 

Theorem 3. // an efficient simulation with accuracy parameter e < 1/3 exists for the family of 
circuits {G{g = 0)} C GCnad, then BQP C AM. 

The idea behind the proof is the following. The classical probabilistic simulation of G{g = 0) G 
QCnad uses a certain number of random coins. For some set of values of these coins the simulation 
outputs (1) the Bell measurement outcomes corresponding to the guess string 5 = such that we 
know that the simulated circuit performs a successful simulation of some quantum computation 
M and (2) the bit value 1 as the outcome of this quantum computation M. Thus the size of this 
set of coin values depends on whether M outputs 1 with large probability or small probability, 
corresponding to the decision problem that M solves. The estimation of the approximate size of a 
set is a problem that is known to be in AM. 

Here are the details of the proof: 

Proof. Let L G BQP and let {Gx} £ QCad be the uniformly generated family of quantum circuits, 
of the Gottesman-Chuang type, that output a bit M{x) that decides L; thus if x G L, M{x) = 1 
with probability at least 2/3, while if x ^ L, M{x) = 1 with probability less than 1/3. Consider the 
corresponding nonadaptive version of these GG circuits Gx {g = 0) where g is the guess bit string 
(l^l = k) for all the Bell measurements. We will be interested in two of the outputs of the circuit 
Gxig = 0): The bit string y giving all the Bell measurement outcomes, and the decision bit M'[x) 
where M' is a function that coincides with M when y = g = 0, and does not, in general, coincide 
with M when y ^ 0. Since all Bell measurement outcomes are equally likely (see Appendix A), 
that is, p{y) = 1/2^ for all y, then if x G L, p{y = g, M{x) = 1) > (2/3) x (1/2^^). 

The classical probabilistic simulation of the circuit Gx{g = 0) takes as input a set of n 
random bits r [n = poZy(|x|)), the description of the circuit Gx{g = 0) (note that it is necessary 
that n>\g\= k), and the input x. The machine outputs (y,M'(x)) in poly{n) time; thus, we 

can express the input-output relation of the simulation as {r,Gx{g = 0),x) — i (y,M'{x)). Since 
S'e is a good simulation of Gx, there exist a set of values for the random bits r such that the Bell 
outcomes agree with the guesses, {r,Gx{g = 0),x) — ^ (y = 0,M(x)). In fact, according to the 
accuracy parameter e condition of Definition IHl we have that, for this simulation, p{y = 0, M(x) = 
l)s«m ^ (1 — €)(2/3) X 2"^^'. Since there are 2" strings r, the total size of this set S of random 
coin settings for which y = and M(x) = 1 is at least BIG = (1 — e)(2/3) x 2'^~^; if x ^ L, then 
the size of the set S for which y = and M(x) = 1 is guaranteed to be less than or equal to 
SMALL = (l + e)(l/3) x 2""^ 

Thus, if the simulation exists, then the problem of deciding whether input x is in a BQP 
language L or not is equivalent to determining whether this set S of n-bit strings is larger than 
or equal to size BIG or smaller than or equal to SMALL, where membership in the set is easy to 
determine (in polynomial time) by running the simulation S^. If e < 1/3, then we are guaranteed 
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that BIG > SMALL. This problem of determining "approximate set size" is known to be solvable 
as a two-round AM game (see Lemma 1 in |(TS86j ). In Appendix B we explain how the game 
proceeds. □ 



How unlikely is the containment BQP C AM? Nothing is definitely known, but the consensus 
is that it is rather unlikely. 



5 Conclusion 

The nonadaptive Gottesman-Chuang circuit is a very curious resource. According to the evidence 
given by this paper, its multiple-bit output is hard to generate classically. Still, it is an open 
question whether, for example, a class such as BPP^''"'"* would have additional power over BPP 
(see for example the recent results in Ref. |F(irHZn3] ). 

From an experimental physics point of view it is clear that it would be extremely interesting to 
find a problem in BPP^''"'"* which is not known to be in BPP; a constant-depth quantum circuit 
should be easier to build than a universal quantum computer. 

Our Theorem 1 holds for any adaptive quantum computation model with its corresponding 
nonadaptive version, including, for example, the Knill-Laflamme-Milburn (KLM) scheme. So, 
our results can be viewed as evidence that a nonadaptive KLM scheme, i.e. mere linear optics on 
Fock states followed by photon counting measurements, may perform some interesting non-classical 
computation. 
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A Appendix: Bell outcomes 

In the Gottesman- Chuang circuit (adaptive or nonadaptive) , each Bell measurement is performed 
on uncorrelated qubits, one of which is a qubit "1" or qubit "4" of the state ^c- Thus, the density 
matrix of the two-qubit system has the form 

PAB = ^I® PB (4) 
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for some choice of the AB labels. The probability that the Bell measurement outcome is, say, 
is by standard quantum mechanical rules {^~^\pab\^^) = 

^{{oo\i pbIoo) + (oo|/ ® pB\n) + pbIoo) + pB\n)) = ^Ttpb = ^, (5) 

and similarly for the other three Bell states. Thus the probability of outputting any bit pair is 
uniform (p = 1/4) as claimed. 

B Appendix: Approximate Set Size 

We begin with a guaranteed separation of set sizes, BIG/SMALL > The first step is to amplify 

this ratio to a larger number, say BIG/SMALL = d/8 (we follow here the notation of the lemma 
in [(TS86 )■ by considering u = log(d/8)/ log(^iq^) runs of the simulation; that is, we consider the 
new set S' = S X S X . . . x S^ . Given that S' is a subset of all u x n-bit strings, and p = [Slog BIGJ 

u 

(i.e. p ~ u{n — k)), the game proceeds as follows: 

• Arthur, the verifier, picks at random I = p + 1 hash functions hi,...,hi, h : S"" — > and P 
random bit strings Z = {zi, zp}, Zj G S^; all these are sent to Merlin, the prover. The 
hash may be of the Carter- Wegman type |C W79j . so each hash function is specified by a 
un X p random Boolean matrix. 

• Merlin attempts to respond with t £ S' such that, for some i, hi{t) G Z. 

With a suitably chosen amplification factor, the game can succeed with almost certainty (but 
not absolute certainty); that is, if x £ L, according to GSE^ (see also JGSS9] , the probability that 
Merlin can supply a proof if |S'| > BIG is at least as large as 1 — 2~'/®, while if |S'| < SMALL the 
probability that Merlin can give a proof is no greater than l^/d. Thus, we can make the failure 
probability in both directions exponentially small in |x| (an exponentially large d only requires a 
polynomially large number of repetitions u). 
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